A team of researchers has built an open-source honeypot that changes its own behavior on the fly, aiming to fix the biggest flaw in deception tech: attackers can usually spot a honeypot within a few commands.
The system, called Chameleon, combines three pieces. A BiLSTM classifier sorts incoming traffic into seven threat categories with 99.61% accuracy in about 2 milliseconds. A locally-run Qwen3.5-0.8B language model generates context-aware responses with 90% accuracy in 4.5 milliseconds. Two custom optimization engines then act on those outputs: one adjusts how long the honeypot stalls a connection based on the classifier's anomaly score, and the other evolves the fake environment's structure using the language model's severity readings. In benchmark runs, the researchers say their custom optimizers beat standard versions by wide margins, including a 258.9% gain in best-run fitness for the deception-tree algorithm. Estimated operating cost: about $17 a month.
That price matters as much as the architecture. Commercial deception platforms run $100,000 to $150,000 a year and mostly react to attackers with static playbooks, not live model feedback. A honeypot that costs less than a coffee subscription and adapts in real time changes who can afford to run one, from a Fortune 500 SOC to a solo researcher.
Still, the impressive-sounding percentage gains come from comparing Chameleon's optimizers against generic textbook versions of themselves, not against how long a real attacker actually stays fooled in the wild. That's the number worth watching once this leaves the lab.